Western Digital desktop app exposes Windows and macOS users to attack
The app was vulnerable to privilege escalation and denial of service
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Western Digital’s proprietary file explorer EdgeRover, has received a patch that addresses a critical security vulnerability.
The fixed flaw, tracked as CVE-2022-22998, is a directory traversal bug, which essentially means - people were allowed to access restricted files. Discovered by cybersecurity researcher Xavier Danest, it’s been given a severity score of 9.1.
The good news is that theendpointalready needs to be compromised, if this vulnerability is to be abused. In a published advisory, the company said very little about the flaw itself, other than if successfully exploited, could lead to the disclosure of sensitive information or denial-of-service.
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time. Thank you for taking part.
Click here to start the survey in a new window«
A patch is available
All EdgeRover users are advised to update their endpoints to version 1.5.1.-594, or newer. The fix corrects both file and directory permissions.
Western Digital did not say if the vulnerability was abused in the wild throughvirusesormalware. It’s even difficult to say how many people use EdgeRover, but given the overall popularity of Western Digital, as a brand, it’s safe to assume that some people could be vulnerable.
EdgeRover is a personal content management application, for Western Digital and SanDisk hardware, promising simplicity, usability, as well as advanced features such as powerful search, categorization, the detection of duplicate files, and similar.
The application is available for both Windows and Mac OS.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Western Digital warns owners of My Cloud hard drives to update immediately>Has Western Digital just unveiled the future of the hard drive?>Western Digital unveils new SanDisk professional line-up
Just like any other hardware manufacturer out there, Western Digital is no stranger to vulnerabilities. Late last year, it warned owners of the My Cloud NAS devices to update to the latest firmware immediately, as the older versions were being terminated due to an increasing number of attacks.
“My Cloud OS 5 is a major and fundamental security release that provides an architectural revamp of our older My Cloud firmware and adds new defenses to thwart common classes of attacks,” WD explained back then.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
NYT Strands today — hints, answers and spangram for Sunday, November 10 (game #252)
